A High Court action has been brought against YouTube for their use of children’s personal data for marketing purposes in breach of the Data Protection Act 2018 (DPA 2018).
Under Section 9 of the DPA 2018 and Article 8(1) of the General Data Protection Regulations (GDPR), children cannot consent to their data being processed until they reach the age of 13. This means that the consent of a child’s parent or guardian should instead be obtained in order to lawfully process the data. The particulars of the claim refer to YouTube failing to distinguish between users who are children under the age of 13 and adult users. YouTube, therefore, have no way of telling which users are lawfully able to give their consent.
YouTube have sought to argue that their platform is not for children under the age of 13 (as stated within their terms and conditions) and that they have launched the YouTube Kids App specifically to protect children on YouTube.
It is, however, important to note that the Information Commissioner’s Office’s (ICO) guidance is clear: even if a business is not actively looking to process children’s data, it still needs to be considered whether children can still access the service. Whilst YouTube claim that their site is not to be used by children under the age of 13, there does not seem to be any safety mechanisms preventing children from accessing the site. Further, the ICO makes it clear that if you process children’s data or you think that you might, you need to consider how you are to protect their data from the outset.
Given that YouTube do not place any kind of restriction on their site, arguably it would have been within their contemplation that they might be processing children’s data and, with this in mind, they should have ensured that such processing was compliant with the DPA 2018 and GDPR.
Comment
The ICO make it incredibly clear that a certain level of protection is needed when collecting and processing children’s personal data, as they are likely to be less aware of the risks involved. It is extremely important that businesses and organisations put in place the relevant systems to protect such interests from the outset.
This is the first class action brought against a technology firm on behalf of children and it will be interesting whether this case will open the flood gates with us seeing similar cases in the future.
How can Nelsons help?
Ruby Ashby is an Associate in our expert Dispute Resolution team.
If you have any questions in relation to the subjects discussed in this article, please contact Ruby or another member of the team in Derby, Leicester or Nottingham on 0800 024 1976 or via our online enquiry form.